site
Server Details
Cyber Essentials Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
- Status
- Healthy
- Uptime
- 99.8% over 41 days
- Last Tested
- Transport
- Streamable HTTP · MCP 2025-11-25
- URL
TDQS
Scored across 3 tools
The three tools target clearly different aspects: enquiry_describe explains process/behavior, enquiry_fields returns the schema, and submit_enquiry performs the action. They are mostly distinct, though enquiry_describe and enquiry_fields are both read-only metadata and an agent might briefly conflate them before reading.
Two tools use a noun-prefix pattern (enquiry_describe, enquiry_fields) while the third uses a verb_noun pattern (submit_enquiry). The shared 'enquiry' root helps readability, but the ordering convention is mixed.
Three tools is on the lean side, but the server has a single narrow purpose (submitting one type of enquiry), so a describe/fields/submit triad is well-scoped rather than under-built.
The surface covers discovery (describe, fields) and the full two-step consent-then-submit flow, including a confirmation token handshake. Minor gap: no way to check submission status or cancel, but the core lifecycle is covered.
Available Tools
3 toolsenquiry_describeWhat you get: an ENQUIRY with a human (not a purchase, not a guaranteed quote)AInspect
Read first. States plainly what submit_enquiry does on Cyber Essentials Cost: it starts an enquiry with human providers who quote directly. Nothing is bought, ordered or paid; no quote is guaranteed; it is free. Also returns who receives the details, the consent wording, and how the person confirms.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the disclosure burden. It states that the underlying process is free, involves no purchase/order/payment, and guarantees no quote – key behavioral guarantees for an agent. It also reveals what the tool returns (recipients, consent wording, confirmation method), though it does not mention auth, rate limits, or side effects of the tool itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is about 70 words and front-loads the instruction 'Read first.' It is slightly redundant with the title (both mention 'not a purchase, not a guaranteed quote'), but every sentence adds some content about behavior or return value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a 0-param tool with no output schema, the description adequately covers what the tool returns (recipient details, consent wording, confirmation) and clarifies the non-transactional nature. It does not detail output format or mention sibling enquiry_fields, but for a simple informational tool this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds relevant context about the output even though there is nothing to say about parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: it 'states plainly what submit_enquiry does' and explains the enquiry outcome (human providers, no purchase, free). It explicitly differentiates from the sibling submit_enquiry by describing rather than performing the action, and the title reinforces the boundary ('not a purchase, not a guaranteed quote'). The verb 'describe' is implied by the name and the explanatory language.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening 'Read first' is an explicit when-to-use instruction, positioning this tool as the prerequisite before submit_enquiry. It does not mention when to use enquiry_fields or explicitly exclude other tools, so it stops short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
enquiry_fieldsThe questions the enquiry asksAInspect
Every field of the Cyber Essentials Cost enquiry: key, label, type, whether required, help text and the allowed options where there are any. Pass answers to submit_enquiry keyed by field key.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the behavioral disclosure. It describes the output content (fields and their attributes) but does not explicitly state that this is a read-only operation or that it has no side effects. However, the nature of returning field metadata strongly implies a safe query. It also does not mention potential errors, auth requirements, or response format beyond the attributes. The description adds some transparency but leaves room for assumptions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary purpose and then a direct usage hint. Every word earns its place—no redundancy or filler. The structure is efficient and immediately informative, making it easy for an agent to parse the tool's role.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters, no output schema, and a straightforward purpose, the description is largely complete. It specifies exactly what information is returned (key, label, type, required, help text, options) and how to use it. It does not mention pagination or list structure, but given the simplicity, these are minor gaps. The description sufficiently equips an agent to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description adds semantic value by explaining how the returned field keys should be used ('Pass answers to submit_enquiry keyed by field key'), which clarifies the purpose of the output. Since there are no parameters to describe, the description adequately covers the interaction pattern.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: returning every field of a specific enquiry (Cyber Essentials Cost) along with their attributes. It names the resource (enquiry fields) and the verb (return/describe), and it distinguishes itself from siblings like submit_enquiry by focusing on field metadata, not submission. The mention of 'every field' and the specific attributes (key, label, type, etc.) makes the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear usage context: it tells the agent to use this tool to retrieve field definitions before passing answers to submit_enquiry. It explicitly links the output to the next step ('Pass answers to submit_enquiry keyed by field key'). While it does not explicitly state when to avoid this tool, the context implies it is a prerequisite for submission and distinct from enquiry_describe. This is sufficient guidance for typical use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_enquirySubmit an ENQUIRY to human providers (two steps; not a purchase)AInspect
Submits an enquiry to Cyber Essentials Cost — NOT a purchase, NOT a guaranteed quote. Step 1: call with the answers (keyed by field key from enquiry_fields) and consent=true; it validates and returns a summary, the consent line and a confirmation token — show the person the summary and the consent line. Step 2: only if the person agrees, call again with the same answers, consent=true and the confirmation token; the enquiry is then submitted, and the person receives an email with a link they must click before any provider sees it. Consent means the person has read and agreed to: "Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
| Name | Required | Description | Default |
|---|---|---|---|
| answers | Yes | the person's answers, keyed by field key | |
| consent | Yes | true only when the person has agreed to: Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them. | |
| confirmation | No | the confirmation token from step 1, after the person has approved the summary |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so: it discloses the two-call validation flow, what step 1 returns (summary, consent line, token), that submission is only completed on step 2, and the downstream side effect that the person must click an emailed link before any provider sees the enquiry. It also spells out the consent scope (details shared with up to three providers, direct contact, per-firm notification, ability to stop).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose and clearly segmented into Step 1 and Step 2, so structure is strong. It loses a point because the full consent sentence is quoted verbatim, duplicating text already present in the consent parameter description in the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by describing exactly what step 1 returns and what happens after step 2, along with the consent obligation. For a nested-object, two-phase submission tool this is complete enough to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds real meaning beyond it: answers are keyed by field key from the enquiry_fields tool, consent must be true in both steps, and confirmation is described as the token produced by step 1 and only sent after approval. The workflow binding of confirmation is not evident from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (submits) and resource (an enquiry to Cyber Essentials Cost) and explicitly disclaims what it is not ('NOT a purchase, NOT a guaranteed quote'). The two-step framing plus the 'human providers' scope distinguishes it clearly from the enquiry_fields/enquiry_describe siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use conditions for each step: Step 1 'call with the answers... and consent=true', Step 2 'only if the person agrees', and names the prerequisite (confirmation token from step 1). It also specifies the gating action (show the summary and consent line) that must occur before step 2 is permissible.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
submit_enquiry1 field changed- changed
Input schema / properties / consent / descriptionPrevious value: -"true only when the person has agreed to: Send my contact details to up to three relevant Cyber Essentials certification bodies and consultants, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."New value: +"true only when the person has agreed to: Send my contact details to up to three Cyber Essentials and penetration testing providers, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
1 tool update
- Changed
submit_enquiry1 field changed- changed
Input schema / properties / consent / descriptionPrevious value: -"true only when the person has agreed to: Happy for my details to go to relevant Cyber Essentials certification bodies and consultants, who'll contact me directly."New value: +"true only when the person has agreed to: Send my contact details to up to three relevant Cyber Essentials certification bodies and consultants, chosen by Cyber Essentials Cost, who'll contact me directly. I'll be emailed each firm's name as my details go to it, and can stop any more firms getting them."
3 tool updates
- First observed
enquiry_describe - First observed
enquiry_fields - First observed
submit_enquiry
Related MCP Connectors
Penetration Testing Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Cyber Insurance Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Underpinning Costs: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
ISO Certification Cost: the site's own MCP server — enquiry (enquiry = a human handoff, not a...
Related MCP Servers
- AlicenseAqualityBmaintenanceUK due diligence MCP server — Companies House, corporate research, compliance checks1849 PyPI3MIT
- FlicenseNot gradedqualityDmaintenancePaid remote MCP server for agent data-access boundary reviews, permission scope evidence, sensitive data notes, and governance receipts.-

CodexRun Ledger MCPofficial
FlicenseNot gradedqualityDmaintenancePaid remote MCP for generating trustworthy code run receipts, scope summaries, missing evidence checks, and client handoff exports.-- AlicenseNot gradedqualityDmaintenanceTurn Claude into an ISO 27001 compliance assistant — controls, risk register, policies, evidence tracking, SoA generation, and full audit workflows in one local encrypted MCP server.28 npmMIT
Glama MCP Gateway
Add one secure layer between your agents and this server.